The more merchant service providers I talk with, the more amazed I am about how most sales reps have no knowledge of the Payment Card Industry Data Security Standard (PCI DSS). This is such a shame, since it is a huge disservice to the clients they serve. That may sound harsh, but they make a living as the "expert" the merchants turn to for their credit card needs, while the "expert" does not understand the fundamental principles of the PCI DSS and how it applies to merchants.
There are many compelling reasons for Small and Medium Businesses (SMBs) to implement Information Security policies. Specifically, the PCI DSS is arguably the most significant liability facing merchants today and most are completely unaware of it. The PCI DSS applies to every organization that processes credit or debit card information, including merchants and third-party service providers that store, process or transmit credit card/debit card data. If you are a merchant, PCI compliance is not a request, nor a suggestion - it is now a requirement, regardless of your size or location.
For a merchant, the liabilities resulting from being non-PCI DSS compliant at the time of an incident include:
- Fines from the PCI
- Being held accountable for the complete amount of fraudulent charges
- Being charged for the costs associated with the breach (e.g. legal fees, card reissue fees, etc)
- Possible cancellation of the merchant services account
- Being found negligent by not meeting a known industry requirement (insurance carriers generally will not cover claims when a company is found negligent, due to the negligence loophole)
- Lawsuits from ID theft victims / disgruntled clients due to the breach (lawsuits will not be covered by insurance, due to the negligence finding, so the client may be forced into bankruptcy)
The 12 requirements of the PCI DSS are:
- Install & maintain a firewall connection to protect cardholder data.
- Do not use vendor-supplied defaults for system passwords and other security parameters.
- Protect stored cardholder data.
- Encrypt transmission of cardholder data across open, public networks.
- Use and regularly update anti-virus software or programs
- Develop & maintain secure systems and applications.
- Restrict access to cardholder data by business need-to-know.
- Assign a unique ID to each person with computer access.
- Restrict physical access to cardholder data.
- Track & monitor all access to network resources & cardholder data.
- Regularly test security systems & processes.
- Maintain a policy that addresses Information Security for employees and contractors.
With the consequences ranging from fines to devastating lawsuits, precautionary measures pale in comparison to the reactive costs associated with cleaning up from non-compliance breaches. As a merchant, if you are non-compliant at the time of an incident, the PCI will hold you liable for 100% of the fraudulent charges, as well as the costs to reissue credit cards to affected cardholders. Additionally, by failing to meet PCI DSS compliance standards that result in identity theft to a client, a reasonably competent attorney can quite easily demonstrate negligence on your behalf. Failing to meet compliance requirements can be used against you in a lawsuit, since industry standards, such as the PCI DSS, are the benchmarks used to demonstrate negligent behavior in a court of law.
The bottom line is the compliance cost associated with the PCI DSS is an unavoidable cost of doing business. In order to decrease the burden associated with this process, we can provide a cost-effective, customized Information Security Policy Manual (ISPM) for merchants. This ISPM covers the PCI DSS and more, so you will be able to implement and document the security of your computer network. Having the ISPM and implementing the steps to securing your network will demonstrate due care and due diligence on your behalf, which is the first step in mitigating your liabilities, as well as becoming PCI DSS compliant.
The benefits of Information Security for small and medium businesses are many:
- Decreased costs - less reactive IT support
- Improved productivity - decreased distractions
- Decreased virus & spyware outbreaks
- More efficient operations
- Better performing network & computers
- Better accountability of assets & resources
- Better educated & trained employees
On a positive note, PCI members, such as Visa, offer safe harbor protection from fines in the event a merchant or service provider experiences a data compromise. To attain safe harbor status, merchants and service providers must:
- Maintain full compliance at all times. This includes adhering to all requirements at the time of a breach or compromise, as demonstrated during a forensic investigation.
- Demonstrate that, before the compromise, the merchant or service provider already met the compliance validation requirements, demonstrating full compliance with the PCI DSS.
If you are merchant service provider and would like to offer an Information Security Policy Manual (ISPM) to your clients, we can establishe an affiliate relationship.Please contact tcornelius@teamlogicit.com for more details or visit www.PCIDSSpolicy.com.
Comments